Today's computer systems are subject to breaches by malicious code, such as computer viruses and worms. Early detection and capture of such breaches would be beneficial as this data can be analyzed and used to protect a computer system from future attacks. There are several ways that can be used to capture a security breach. A user can submit malicious code samples after the user's computer has been attacked. A problem with this method is that the user's system is already breached with possibly severe consequences. Another way to obtain information about a potential attack is to obtain sample code from sharing groups. However, this kind of information can be unreliable. Yet another way of obtaining information is via a honey pot.
Honey pots are computer programs or systems that are meant to be breached for the purpose of capturing information associated with the breach. Such information can then typically be analyzed in an attempt to understand and prevent future attacks. Types of honey pots can include synthetic honey pots and sacrificial honey pots. Synthetic honey pots emulate services which can be attacked, and are typically easy to deploy and manage. However, synthetic honey pots can be development intensive and typically do not fully emulate a real system. Sacrificial honey pots can be actual computer systems, permitting the honey pot to capture attacks that may occur in a real environment. However, a sacrificial honey pot can take a significant amount of time to set up and manage. For example, once a honey pot is breached, analysis and subsequent redeployment of the honey pot are typically performed manually. Thus, it would be desirable to have a technique for capturing a security breach that is efficient to deploy and manage.